src/modules/rlm_attr_filter/rlm_attr_filter.c

   1 /*
   2  * rlm_attr_filter.c  - Filter A/V Pairs received back from proxy reqs
   3  *                      before sending reply to the NAS/Server that sent
   4  *                      it to us.
   5  *
   6  * Version:      $Id$
   7  *
   8  *   This program is is free software; you can redistribute it and/or modify
   9  *   it under the terms of the GNU General Public License, version 2 if the
  10  *   License as published by the Free Software Foundation.
  11  *
  12  *   This program is distributed in the hope that it will be useful,
  13  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *   GNU General Public License for more details.
  16  *
  17  *   You should have received a copy of the GNU General Public License
  18  *   along with this program; if not, write to the Free Software
  19  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  *
  21  * Copyright (C) 2001,2006 The FreeRADIUS server project
  22  * Copyright (C) 2001 Chris Parker <cparker@starnetusa.net>
  23  */
  24
  25 #include        <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include        <freeradius-devel/radiusd.h>
  29 #include        <freeradius-devel/modules.h>
  30 #include        <freeradius-devel/rad_assert.h>
  31
  32 #include        <sys/stat.h>
  33
  34 #include        <ctype.h>
  35 #include        <fcntl.h>
  36 #include        <limits.h>
  37
  38
  39 /*
  40  *      Define a structure with the module configuration, so it can
  41  *      be used as the instance handle.
  42  */
  43 struct attr_filter_instance {
  44         char *attrsfile;
  45         char *key;
  46         PAIR_LIST *attrs;
  47 };
  48
  49 static const CONF_PARSER module_config[] = {
  50         { "attrsfile",     PW_TYPE_FILENAME,
  51           offsetof(struct attr_filter_instance,attrsfile), NULL, "${raddbdir}/attrs" },
  52         { "key",     PW_TYPE_STRING_PTR,
  53           offsetof(struct attr_filter_instance,key), NULL, "%{Realm}" },
  54         { NULL, -1, 0, NULL, NULL }
  55 };
  56
  57 static void check_pair(VALUE_PAIR *check_item, VALUE_PAIR *reply_item,
  58                       int *pass, int *fail)
  59 {
  60         int compare;
  61
  62         if (check_item->operator == T_OP_SET) return;
  63
  64         compare = paircmp(check_item, reply_item);
  65         if (compare == 1) {
  66                 ++*(pass);
  67         } else {
  68                 ++*(fail);
  69         }
  70
  71         return;
  72 }
  73
  74 /*
  75  *      Copy the specified attribute to the specified list
  76  */
  77 static int mypairappend(REQUEST *request, VALUE_PAIR *item, VALUE_PAIR **to)
  78 {
  79         VALUE_PAIR *tmp;
  80         tmp = radius_paircreate(request, to, item->attribute, item->type);
  81
  82         /*
  83          *      Copy EVERYTHING.
  84          */
  85         memcpy(tmp, item, sizeof(*tmp));
  86         tmp->next = NULL;
  87         *to = tmp;
  88
  89         return 0;
  90 }
  91
  92 static int getattrsfile(const char *filename, PAIR_LIST **pair_list)
  93 {
  94         int rcode;
  95         PAIR_LIST *attrs = NULL;
  96         PAIR_LIST *entry;
  97         VALUE_PAIR *vp;
  98
  99         rcode = pairlist_read(filename, &attrs, 1);
 100         if (rcode < 0) {
 101                 return -1;
 102         }
 103
 104         /*
 105          * Walk through the 'attrs' file list.
 106          */
 107
 108         entry = attrs;
 109         while (entry) {
 110
 111                 entry->check = entry->reply;
 112                 entry->reply = NULL;
 113
 114                 for (vp = entry->check; vp != NULL; vp = vp->next) {
 115
 116                     /*
 117                      * If it's NOT a vendor attribute,
 118                      * and it's NOT a wire protocol
 119                      * and we ignore Fall-Through,
 120                      * then bitch about it, giving a good warning message.
 121                      */
 122                     if (!(vp->attribute & ~0xffff) &&
 123                          (vp->attribute > 0xff) &&
 124                          (vp->attribute > 1000)) {
 125                         log_debug("[%s]:%d WARNING! Check item \"%s\"\n"
 126                                   "\tfound in filter list for realm \"%s\".\n",
 127                                   filename, entry->lineno, vp->name,
 128                                   entry->name);
 129                     }
 130                 }
 131
 132                 entry = entry->next;
 133         }
 134
 135         *pair_list = attrs;
 136         return 0;
 137 }
 138
 139
 140 /*
 141  *      Clean up.
 142  */
 143 static int attr_filter_detach(void *instance)
 144 {
 145         struct attr_filter_instance *inst = instance;
 146         pairlist_free(&inst->attrs);
 147         free(inst);
 148         return 0;
 149 }
 150
 151
 152 /*
 153  *      (Re-)read the "attrs" file into memory.
 154  */
 155 static int attr_filter_instantiate(CONF_SECTION *conf, void **instance)
 156 {
 157         struct attr_filter_instance *inst;
 158         int rcode;
 159
 160         inst = rad_malloc(sizeof *inst);
 161         if (!inst) {
 162                 return -1;
 163         }
 164         memset(inst, 0, sizeof(*inst));
 165
 166         if (cf_section_parse(conf, inst, module_config) < 0) {
 167                 attr_filter_detach(inst);
 168                 return -1;
 169         }
 170
 171         rcode = getattrsfile(inst->attrsfile, &inst->attrs);
 172         if (rcode != 0) {
 173                 radlog(L_ERR|L_CONS, "Errors reading %s", inst->attrsfile);
 174                 attr_filter_detach(inst);
 175                 return -1;
 176         }
 177         *instance = inst;
 178         return 0;
 179 }
 180
 181
 182 /*
 183  *      Common attr_filter checks
 184  */
 185 static int attr_filter_common(void *instance, REQUEST *request,
 186                               VALUE_PAIR **input)
 187 {
 188         struct attr_filter_instance *inst = instance;
 189         VALUE_PAIR      *vp;
 190         VALUE_PAIR      *output = NULL;
 191         VALUE_PAIR      **output_tail;
 192         VALUE_PAIR      *check_item;
 193         PAIR_LIST       *pl;
 194         int             found = 0;
 195         int             pass, fail = 0;
 196         char            *keyname = NULL;
 197         char            buffer[256];
 198
 199         if (!inst->key) {
 200                 VALUE_PAIR      *namepair;
 201
 202                 namepair = pairfind(request->packet->vps, PW_REALM);
 203                 if (!namepair) {
 204                         return (RLM_MODULE_NOOP);
 205                 }
 206                 keyname = namepair->vp_strvalue;
 207         } else {
 208                 int len;
 209
 210                 len = radius_xlat(buffer, sizeof(buffer), inst->key,
 211                                   request, NULL);
 212                 if (!len) {
 213                         return RLM_MODULE_NOOP;
 214                 }
 215                 keyname = buffer;
 216         }
 217
 218         output_tail = &output;
 219
 220         /*
 221          *      Find the attr_filter profile entry for the entry.
 222          */
 223         for (pl = inst->attrs; pl; pl = pl->next) {
 224                 int fall_through = 0;
 225
 226                 /*
 227                  *  If the current entry is NOT a default,
 228                  *  AND the realm does NOT match the current entry,
 229                  *  then skip to the next entry.
 230                  */
 231                 if ((strcmp(pl->name, "DEFAULT") != 0) &&
 232                     (strcmp(keyname, pl->name) != 0))  {
 233                     continue;
 234                 }
 235
 236                 DEBUG2(" attr_filter: Matched entry %s at line %d", pl->name,
 237                        pl->lineno);
 238                 found = 1;
 239
 240                 for (check_item = pl->check;
 241                      check_item != NULL;
 242                      check_item = check_item->next) {
 243                         if (check_item->attribute == PW_FALL_THROUGH) {
 244                                 fall_through = 1;
 245                                 continue;
 246                         }
 247
 248                         /*
 249                          *    If it is a SET operator, add the attribute to
 250                          *    the output list without checking it.
 251                          */
 252                         if (check_item->operator == T_OP_SET ) {
 253                                 if (mypairappend(request, check_item, output_tail) < 0) {
 254                                         pairfree(&output);
 255                                         return RLM_MODULE_FAIL;
 256                                 }
 257                                 output_tail = &((*output_tail)->next);
 258                         }
 259                 }
 260
 261                 /*
 262                  *      Iterate through the input items, comparing
 263                  *      each item to every rule, then moving it to the
 264                  *      output list only if it matches all rules
 265                  *      for that attribute.  IE, Idle-Timeout is moved
 266                  *      only if it matches all rules that describe an
 267                  *      Idle-Timeout.
 268                  */
 269                 for (vp = *input; vp != NULL; vp = vp->next ) {
 270                         /* reset the pass,fail vars for each reply item */
 271                         pass = fail = 0;
 272
 273                         /*
 274                          *      reset the check_item pointer to
 275                          *      beginning of the list
 276                          */
 277                         for (check_item = pl->check;
 278                              check_item != NULL;
 279                              check_item = check_item->next) {
 280                                 /*
 281                                  *      Vendor-Specific is special, and
 282                                  *      matches any VSA if the comparison
 283                                  *      is always true.
 284                                  */
 285                                 if ((check_item->attribute == PW_VENDOR_SPECIFIC) &&
 286                                     (VENDOR(vp->attribute) != 0) &&
 287                                     (check_item->operator == T_OP_CMP_TRUE)) {
 288                                         pass++;
 289                                         continue;
 290                                 }
 291
 292                                 if (vp->attribute == check_item->attribute) {
 293                                         check_pair(check_item, vp,
 294                                                    &pass, &fail);
 295                                 }
 296                         }
 297
 298                         /* only move attribute if it passed all rules */
 299                         if (fail == 0 && pass > 0) {
 300                                 if (mypairappend(request, vp, output_tail) < 0) {
 301                                         pairfree(&output);
 302                                         return RLM_MODULE_FAIL;
 303                                 }
 304                                 output_tail = &((*output_tail)->next);
 305                         }
 306                 }
 307
 308                 /* If we shouldn't fall through, break */
 309                 if (!fall_through)
 310                         break;
 311         }
 312
 313         /*
 314          *      No entry matched.  We didn't do anything.
 315          */
 316         if (!found) {
 317                 rad_assert(output == NULL);
 318                 return RLM_MODULE_NOOP;
 319         }
 320
 321         pairfree(input);
 322         *input = output;
 323
 324         return RLM_MODULE_UPDATED;
 325 }
 326
 327 static int attr_filter_accounting(void *instance, REQUEST *request)
 328 {
 329         return attr_filter_common(instance, request, &request->packet->vps);
 330 }
 331
 332 static int attr_filter_preproxy(void *instance, REQUEST *request)
 333 {
 334         return attr_filter_common(instance, request, &request->proxy->vps);
 335 }
 336
 337 static int attr_filter_postproxy(void *instance, REQUEST *request)
 338 {
 339         return attr_filter_common(instance, request, &request->proxy_reply->vps);
 340 }
 341
 342 static int attr_filter_postauth(void *instance, REQUEST *request)
 343 {
 344         return attr_filter_common(instance, request, &request->reply->vps);
 345 }
 346
 347
 348 /* globally exported name */
 349 module_t rlm_attr_filter = {
 350         RLM_MODULE_INIT,
 351         "attr_filter",
 352         0,                              /* type: reserved */
 353         attr_filter_instantiate,        /* instantiation */
 354         attr_filter_detach,             /* detach */
 355         {
 356                 NULL,                   /* authentication */
 357                 NULL,                   /* authorization */
 358                 NULL,                   /* preaccounting */
 359                 attr_filter_accounting, /* accounting */
 360                 NULL,                   /* checksimul */
 361                 attr_filter_preproxy,   /* pre-proxy */
 362                 attr_filter_postproxy,  /* post-proxy */
 363                 attr_filter_postauth    /* post-auth */
 364         },
 365 };
 366